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^) • Abstract 

' Unimodal maps have been broadly used as a base of new encryption strategics. Recently, a stream cipher 
has been proposed in the literature, whose keystream is basically a symbolic sequence of the (one-parameter) 
' logistic map or of the tent map. In the present work a thorough analysis of the keystream is made which 
reveals the existence of some serious security problems. 



' Key words: Unimodal maps, symbolic dynamics, stream cipher, known-plaintext attack, control 
parameter estimation, initial condition estimation. 
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1. Introduction 



The partition of the state space transforms a measure-preserving dynamical system into a stationary 
stochastic process called a symbolic dynamics. In the case of chaotic systems (i.e., governed by chaotic 
maps), the resulting symbolic dynamics has some specific properties, like sensitivity to initial conditions and 
strong mixing, which are very attractive for cryptographic purposes. For instance, the symbolic dynamics 
of a chaotic map can be used as a Random Number Generator (RNG) [l[ and, more generally, as a source 
00 ' of entropy. Unimodal maps are particularly useful in this regard, since their generating partitions comprise 
■ two intervals, thus leading to a natural source of Random Bit Generators (RBGs). Among all possible 
applications of RNGs and RBGs in cryptography, their role as keystream generators in stream ciphers is 
especially important. 

CO ' Recently a stream cipher based on the symbolic dynamics of the (one-parameter) logistic map and tent 

, map, was proposed in If the parameter of either map is selected conveniently, then its symbolic sequences 
pass all the statistical tests necessary for their consideration as keystreams. However, we show that this 
requirement is not enough to guarantee the security of this stream cipher and point out some cryptographic 
. ^ weaknesses. 

, The work described in this paper is organized as follows. In Sec. [2] the encryption scheme of 0] is 

$H ' explained. After that, some issues relevant to the security of the cryptosystem are highlighted (Sec. 3). In 
Sec. m the cryptosystem is analyzed taking into account the dynamics of the underlying chaotic system. The 
problems derived from the selection of the logistic and tent maps are also discussed there. Finally, the main 
results and conclusions of the work are summarized in Sec. [H 

2. Description of the encryption scheme 

In the cryptosystem described in 0] the transformation of the plaintext into the ciphertext is done bitwise 
and driven by symbolic sequences generated either by the logistic map or by the tent map. Recall that the 
logistic map is defined as 

/a(x) = Aa-(l-x), (1) 
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for X G [0, 1] and A G [0,4], and the tent map is given by the foUowing equation: 



^^^^ ~ \ {l-x)/{l-\), ifA<x<l, 

where x E [0, 1] and A G (0, 1). Henceforth we will refer to A as the control parameter. 

Given a closed interval / C R and a map / : / ^ / , the orbit of (the initial condition) a; G / is defined 
as the set Of{x) = {/"(x) : n G No}, where Nq = {0} U N = {0, 1, ...}, f°{x) = x and f"{x) = f (/""^(x)). 
A continuous map defined on an interval of M that is increasing (decreasing) to the left of an interior point 
and decreasing (increasing) thereafter is said to be unimodal. Examples of unimodal maps are provided by 
the logistic and tent maps. A unimodal map attains its maximum (minimum) at a single point Xc {xc = 1/2 
for the logistic map, and Xc = A for the tent map), called the critical point, li f : I —> I is unimodal, then 
any orbit can be encoded into a binary sequence, 

B^(/, x) = {B,{f,x)}Zo = 9{f{x))e{f\x)) . . . 0(/^-i(x))..., (3) 
where 9(-) is the step function 

In the plaintext is encrypted through the symbolic dynamics of cither the logistic map or the tent 
map, with fixed control parameter A and initial condition xq. If the plaintext is N bit long, then the first 
m + N points of Of^^xo) are computed with the selected map, and the corresponding symbolic sequence is 
produced. The first m bits of this symbolic sequence are used to bear the initial condition. Indeed, according 
to the theory of symbolic dynamics, given e > and a generating partition a of / with respect to / (like 
the partition a ~ {[0, Xc), [xc, 1]} in the case of unimodal maps of the unit interval), any real number x € I 
can be represented with precision e as a symbolic sequence of / with respect to a, with initial condition x 
and length above a certain threshold Q. Therefore, once the precision e has been set, m is chosen to be 
larger than the corresponding threshold. The scheme proposed in divides the finite binary sequence 

B„+a,(/a,xo) = {B^ih, xo)}T=o'''' - e{f{x))9{f{x)) . . . 0(/™+^-i(x)) 

into two segments: 3'"^" = {Bf^j^o^ ^ith ^1"" = B,{fx,xo), and B'^'^ = {^l^'l^o^ ^it^ = 
Bm+iif\,Xo)- The initial segment B'"'' contains the information on xq up to the precision wished. The 
final segment B"^^ is the keystream of the cipher, i.e., the plaintext P = {Pi}iLo^ is transformed into the 
pre-ciphertext C = {Qlilo^ according to 

Q = © Bf^ = P, e Bm.+^ (/a , ) , (5) 

where i = 0, 1, . . . , TV - 1, and 0©0 = 1©1=0, 0®1 = 1®0 = 1. Finally, the pre-ciphertext C and 
B™'* are combined into the ciphertext or encrypted message M = {M,}™^^ ^ which is sent to the receiver 
through an insecure channel. The generation of M is driven by a shuffler block, implementing an injective 
map TT : {0, 1, • • • , m — 1} ^ {0, 1, • • ■ , — 1, A^}, which inserts the m bits of B""* into the pre-ciphertext C 
according to the following rule, (a) If < 7r(i) < A^ — 1, then _BJ"'' is inserted before C^(i); (b) if 7r(i) = A^, 
then _B""* is inserted after Cn-i, i-c, Mm+N-i = S™''- Thus, a ciphertext with, say, 7r(i) < A' for all i, 
looks as follows: 

M = CoCi • ■ • Ci„_ii3"" Cig ■ ■ ■ Ci^,_j_ii?™_^Ci^_i • • • Cn-1, (6) 

where 7r(jfc) = i^, /c G {0, 1, • • • , m — 1}, and «o < ... < im-i- The shuffler block, i.e., the map tt, is also 
known at the receiver, thus making the recovery of xq feasible. 
In sum, the encryption is done in three steps: 

(1) Symbolic sequence: Bm+jv(/A, a^o) ~ B""*||B'''' (|| stands for "juxtaposition"). 

(2) Pre-ciphertext: C = P © B"^^ (the © operation is bitwise) 
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(3) Ciphertext: M = tt (B""*|| C) (abusing notation, 7r(Si||S2) stands here and henceforth for the action 
of the shuffling map tt on the binary sequence Si ||S2 of length m + iV, as cxemphfied in Eq. (O). 

In order to decrypt M, the receiver extracts B'"'* from M to determine xq] the remaining bits form C. 
This aUows the receiver to rephcate B'^'' by computing the orbit of xq under the selected chaotic map, using 
the right value of the control parameter. Lastly, the plaintext is recovered as 

= C, ® B"^' = a © (/a , a:o ) , (7) 

for fc = 0,1,. ..,iV- 1. 

An explicit definition of the key of the cryptosystem is not given in (J]. Nevertheless, in [i. Sec. 3] it IS 
pointed out that the map selected (either the logistic map or the tent map), its control parameter, and the 
position of the bits of B'"'* in M are necessary to recover the plaintext. Henceforth, it is assumed that the 
key consists of these three elements or "subkeys" . The map tt used in the shuffler block might be given by 
an m-dimensional vector tt = [7r(0), ■ • • ,7r(m — 1)], where 7r(i) is a [log2(-/V + l)]-bit integer. In practice, 
a secret seed s could be used to generate the map tt in a pseudo-random manner; in this case, the subkey 
corresponding to the shuffler reduces to the seed s. 



3. Design problems 

3.1. Key space 

The complete definition of a cryptosystem demands the precise and thorough specification of the set of 
values of the secret key [3, Rule 5]. As mentioned above, the control parameter and the initial condition of 
the chaotic map (necessary to build the pre-cipher text C) are certainly part of the key. In relation with the 
control parameter, the considered maps must be evaluated to guarantee that they evolve chaotically during 
the encryption stage. In the case of the logistic map, the selection of adequate values for A is quite complex 
since the bifurcation diagram of this map possesses a dense set of periodic windows 0]. Therefore, if the 
keystream has to be generated with the logistic map, one must assure that the Lyapunov exponent of f\ is 
positive. 

On the other hand, the tent map is not a good source for generating pseudo-random bits from its 
symbolic dynamics. Since the Lebesgue measure on [0, 1] is an ergodic invariant measure of the tent map for 
all A G (0, 1) it follows that the ratio between the number of 1-bits and 0-bits in a typical orbit coincides 
with the ratio between the lengths of the intervals [A, 1] and [0, A), namely, Therefore, in order to have 
an approximately balanced bit sequence B"*^*^, A should be close to 1/2. 

3.2. Considerations about the synchronization procedure 

In chaos-based cryptosystems, decryption of the ciphertext requires perfect regeneration of the orbit(s) 
involved in the encryption stage. This being the case, the receiver must know the control parameter(s) and 
the initial condition(s) used by the transmitter. Those values can be obtained by the receiver from either 
the secret key or the design specifications. However, the agreement on the initial condition can be settled 
indirectly using synchronization techniques. Indeed, if the chaotic systems at the transmitter and receiver 
are suitably coupled, their orbits converge to each other although they have been derived from different 
initial conditions. Synchronization implies that, after a transient time, the chaotic system(s) at the receiver 
reproduces the dynamics of the chaotic systems(s) at the transmitter, which further allows the recovering 
of the plaintext without knowledge of xq. This is certainly not the case of the cryptosystem proposed in 
since the initial condition have to be known in order to reproduce the keystream B'^''. As a consequence, 
the whole ciphertext must be received before decryption can start while, in conventional synchronization 
schemes, decryption is progressively achieved during the reception of the ciphertext. We conclude that, 
what is called synchronization in 0] is rather a method to codify and send the initial condition, than a usual 
synchronization technique. 

Furthermore, nothing is mentioned in Q about how xq is obtained from B'"''. We briefly address this 
issue here. According to the theory of symbolic dynamics, a symbolic sequence of length L partitions the 
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state interval / into 2^ subintcrvals /]^\ 1 < j < 2^, that is, / = /j^' U ■ • • U 4^', with /j^^ n = 
for j 7^ fc. The binary sequences of length L obtained for each x G /j^^ are the same. Therefore, a given 
symbolic sequence of length L singles out the subinterval /j^^ its initial condition xq belongs to, what 

provides an estimation of xq. The estimation error depends on the width of which in turn depends 
on the map considered. In the case of the symmetric tent map (i.e., the tent map with A = 1/2), all the 
subintcrvals /j^'' have width equal to 1/(2^) (see Fig. [l]). Hence if the first n bits of Bi(/i/2,a;o) locate 
xq in the subinterval [fc/2", [k + l)/2"]. then the bit _B„ determines whether xq belongs to either the left 
{Bn = 0) or the right (i3„ = 1) half of that subinterval. Nevertheless, this dichotomic search cannot be 
done in a general case. Indeed, the subintcrvals /j^-' associated to the logistic map and the tent map with 
A 7^ 1/2 are not equal- width. However, in 0] it is shown that the symbolic sequences of unimodal maps can 
be assigned a linear order. This linear order preserves the order of the corresponding initial conditions in R 
and can be used to estimate xq through a binary search procedure Q. 




Figure 1: Symbolic intervals for different iterations of the symmetric tent map. 



4. Problems derived from the dynamics of the underlying chaotic systems 

A crucial step in the design of a chaos-based cryptosystem is the selection of the underlying chaotic 
map(s). In this section it is shown that the choice of the logistic map and the tent map for the scheme 
proposed in Q implies serious security problems. 

First of all, due to lack of details in 0], it is assumed that the interleaving of the symbolic block B""* 
in the prc-ciphcrtext C to build the ciphertext M, is performed in a random way. In a chosen-plaintext 
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attack, a cryptanalyst has access to the encryption device and thus can obtain the output corresponding 
to any input. If = for < i < — 1, i.e., aU the bits of the plaintext P are chosen to be zero, then 
C = © B'^'' = B'*^, and the corresponding ciphertext is n (B'"''|| B*^*^). CaU this particular ciphertext 
gshuffled^ According to 0], given a symbolic sequence Bi(/A,a;o) of a unimodal map fx (see Eq.Q), both 
the control parameter A and the initial condition xq can be estimated in a straightforward way. Actually, 
the problem we are dealing with is not quite the same, since the available symbolic sequences are distorted 
through the permutation procedure. Nevertheless, we will presently show that the estimation of the control 
parameter is still possible using B"'^"*'=^ = tt (B'""|| B''") instead of B„i+N{f\,xo) = B'""|| B''^ where fx 
is the logistic map or the tent map, and the estimation method depends on fx- Consequently the first step 
in the cryptanalysis of this cipher calls for discerning the chaotic map used in the generation of B'''™*'^°'^, the 
encryption of P = 0. Once this step has been completed, the next step is to estimate the control parameter. 




(a) A = 3.890925 (b) A = 3.999567 



Figure 2: Wootters' distance of the logistic map with respect to the logistic map. The length of the symbolic sequences is 
N = 10^, whereas the words are of width w = 10. 



4-1. Identification of the chaotic map from symbolic sequences 

The dynamics of every chaotic system has some particular characteristics that make it distinct. These 
"fingerprints" are also present in their symbolic dynamics and can be brought to light via statistical compar- 
ison of the corresponding symbolic sequences. A method along these lines exploits the "statistical distance" 
between symbolic sequences to discriminate one chaotic map from another. In this paper we consider the 

statistical distance defined by Wootters Let Pi = (* = 1: 2) be two probabiHty distributions. 

Wootters' statistical distance between Pi and P2 is given by 



Vw{Pi,P2) - 




Since T?iv is calculated from two probability distributions, it is necessary to establish a method to derive a 
probability distribution from the dynamics of a unimodal map. Let Bi(/>,xo) be a symbolic sequence of 
a unimodal map fx- A probability distribution can be obtained from 'BL{fx,xo) just by grouping all bits 
in a sliding window of length w. As a result, a binary sequence of length L is transformed into a sequence 
of L — w! + 1 w-bit integers (or words), taking some of the 2"' possible values. The probability distribution 
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(a) A = 0.138891 



(b) A = 0.409249 



Figure 3; Wootters' distance of the skew tent map with respect to the logistic map for N = 10^ and w = 10. 

associated to 'B^lfx, xq) is determined by counting the number of occurrences of each word and dividing 
the result by L — w + 1. 

In the case under consideration, the sequence B,„+jv(/a, xq) = B'"'*|| B"^^ generated at the transmitter, 
is not accessible to the cryptanalyst. Indeed, as explained in Sec. 3, a chosen-plaintext attack with P = 
returns B*''^"*°'^ = TrCBm+Nifx, xq)) rather than 'Bjn+N{fx,xo), which amounts to the presence of noise in 
the calculated probability distribution. Therefore, the parameters N and w must be selected to guarantee 
a small value of Wootters' distance between the probability distributions obtained from ^m+N{fx, xq) and 
the one derived from B'^'^"®"'^. From this point of view, it is convenient to have a large value of N and a 
small value of w. On the other hand, the value of w should not be very small, since the entropy of the 
probability distribution must be as close as possible to the entropy of the underlying chaotic system to 
achieve an accurate reconstruction of the dynamics involved. Our experience shows that the choice w > 10 
and N > 10^ implies a drastic reduction of the noise induced by the shuffling process. 

Wootters' distance can be used, for example, to estimate the control parameter of the logistic map. 
This task is carried out by computing Wootters' distance from the symbolic sequence B''^"*^'''^ (generated 
with an unknown value A of the control parameter) to the symbolic sequences generated with A ranging 
in an interval. These distances are computed in Fig. [5] for two values of A with N = 10^ and w = 10; 
the corresponding symbolic sequences were generated with different initial conditions. Figure [2] shows that 
around the right value of A there exists a basin of attraction, which leads immediately to an estimation of 
A. Furthermore, the basin of attraction is always easily observed independently of the shuffling procedure, 
as it has been verified through different simulations and random interleaving of B'"'' and B"^^. 

If we consider now a symbolic sequence of the tent map with control parameter A, then Wootters' distance 
to the logistic map produces a picture with no basin of attraction (sec Fig.[3^a), where the Wootters' distance 
is always upper 0.9) or with a basin of attraction around A = 4 (see Fig. ISl^b)). In this case, we conclude 
that the chosen map is the logistic map with A = 4, or the tent map with an unknown value for the control 
parameter. A further analysis of Wootters' distance to the tent map makes possible to discard the logistic 
map in this situation. Figure S] depicts Wootters' distance to the tent map when B^*^"*''^'^ is generated using 
the tent map with two different values for A. Again, it is possible to discern a basin of attraction around A, 
which has been verified for different random configurations of the interleaving of B'"'* and B'^*'. Nevertheless, 
there is an especial situation where it is impossible to distinguish the logistic map from the tent map. It 
occurs for the logistic map with A = 4 and the skew tent map with A = 0.5. In this situation, both maps 
are topological conjugate [ll|, p. 68] and the Wootters' distance of the logistic map with respect to the tent 
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map shows a basin of attraction around A = 0.5. Nevertheless, from a practical point of view it is possible 
to discern between both maps even when there exists topological conjugacy, since when working with finite 
precision arithmetics the symmetric tent map possesses a "digitally stable" □ fixed point at x = 0. The effects 
of digital degradation for the symmetric tent map can be observed in Fig. U) Indeed, digital degradation is 
the reason why Wootters' distance with respect to the tent map always shows peaks at A = 0.5. However, if 
the Wootters' distance of the logistic map with A = 4 to the skew tent map is calculated, we can observed 
that it appears a peak instead of a basin of attraction (see Fig.[5lja)), which can be used to distinguish the 
logistic map from the skew tent map when the theoretical condition of topological conjugacy is satisfied. As 
a matter of fact, digital degradation causes a dependency of the shape of Wootters' distance with respect to 
the initial condition of the given symbolic sequence, and also with respect to the quantization steps used in 
its computation. Future work will be focused on the further and thoroughly examination of that dependence. 

We conclude that Wootters' distance between a given symbolic sequence and a large set of symbolic 
sequences of the logistic map, can discriminate which chaotic map has been used in the encryption procedure. 
Furthermore, Wootters' distance leads to an estimation of the control parameter of both the logistic map 
and tent map, which can be further improved as it is shown next. 

4-. 2. Estimation of the control parameter from symbolic sequences 

As mentioned above, the method to estimate the control parameter from symbolic sequences depends on 
the underlying chaotic map. In the case of the logistic map, the critical point does not depend on the control 
parameter, whereas the control parameter determines the critical point for the tent map. This explains the 
need for different estimation methods. 

4-2.1. Control parameter estimation for the logistic map 

A method to estimate the control parameter of unimodal maps with a fixed critical point using symbolic 
sequences, can be easily derived from the results of 0], as shown in Q, and applied to cryptanalysis in 
[ii, [3, [H. As it was mentioned above, in [7| it is proved that for a certain family of unimodal maps 
which includes both the logistic map and the tent map, it is possible to assign a linear order to their 



^The term "digitally stable" means that the fixed point is stable under finite computing precision. That is, any chaotic 
orbit will finally lead to a: = after a limited number of iterations. The number of iterations has an upper bound determined 
by the finite precision. Some discussions on this phenomenon with floating-point arithmetic can be found in |l2j | . 
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(a) (b) 

Figure 5: Wootters' distance of the (a) logistic map for A = 4 and xq = 0.593563; and (b) the skew tent map for A = 0.5 and 
xq = 0.213988 respect to the skew tent map for N = and w = 10. The quantization steps of x- and y-axis are 2^" and 2^** 
respectively. 

symbolic sequences, denoted by <, that preserves the order of the corresponding initial conditions in M. To 
be specific, if / C M is a closed interval and f : I ^ I belongs to T, then (i) Bi(/, xi) < Bl(/, X2) implies 
xi < X2, and (ii) xi < X2 implies Bi(/, xi) < Bi(/, a;2), where xi,X2 S I- In particular, for the logistic 
and tent maps it follows: 

(A) HlUxix) < 'BL{fx,f\{xc))yx G [0,1], eventually after a transient orbit in the case of the logistic 
map. 

(B) If Ai < A2, then Bl(/ai , /ai (xc)) < Bl(/a2, fx2{xc)), since the critical value f\{xc) is a non-decreasing, 
monotone function of A. 

The estimation of the control parameter of the logistic map fx is based on (A) and (B), and it proceeds 
in two stages. 

1. Search for the maximum binary sequence of length I < L contained in ^L{f\,XQ). 

2. Use the maximum binary sequence and the monotonic relation between ^i{f\,f\{xc)) and A, to get 
an estimation of A through a binary search procedure . 

In the scheme defined in L = m + and, as mentioned before, a chosen-plaintext attack with P = 
returns B'''^"®°'^ = nCBm+Nifx, xo)) instead of Bm+Nifx, xq) = B'"''|| B^"^. This problem can be overcome 
by considering not only the maximum binary sequence of length Z < m + iV in 'Bm+Nifx, xq), but the 
set of the, say, Q greatest sequences of length I. If the interleaving of B'"'' in B*^** is done randomly, it 
was verified experimentally that for Q large enough, the set of the Q greatest sequences of length I always 
includes Bf'^^ffA, xn) or a good estimation of it, Wi^^^{f\,xo) being the maximum sequence obtained from 
Bm+Ar(/A, xo). In [15[ it is pointed out that a good estimation of A requires values of Q over 10^ « 2^" (a 
typical number in actual chosen-plaintext attacks); the estimation error lies then below 10"'^ (see Fig.l in 
[l5|). In our case, this estimation is also degraded by the fact that the method is applied on approximated 
values of 'Bf'^^^{f\,xo). Needless to say, an estimation of A amounts to reducing the key space, and this 
compromises the security of the cipher. All in all this analysis underlines the critical role of the shuffler in 
the encryption scheme of 
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Figure 6: Error in the estimation of the control parameter of the tent map from the ratio between 1-bits and 0-bits in B' 



4-2.2. Control parameter estimation for the tent map 

The method described in the previous section does not apply to the tent map because its critical point 
depends on the control parameter: = A. In this case, we can resort to the analysis of the ratio between 
1-bits and 0-bits in symbolic sequences of the tent map. As it was emphasized in Sec. 13.11 this ratio is 
equal to i? = hence it can be used to estimate of the control parameter. Moreover, the number of 

1-bits and 0-bits is not modified by the shuffling procedure, so the estimation of the control parameter can 
be performed on B''^"*^°'^ instead. Fig. [H shows the error in the recovery of the control parameter from 
the ratio R obtained with different B''^"**'°'^ and A ranging in (0, 1). The estimation error decreases as the 
length of the plaintext N increases, but a perfect recovery of A requires not only large values of N but also 
extended-precision arithmetic libraries. Indeed, when implementing the cryptosystem, the shortcomings of 
finite precision arithmetic and finite statistical sampling causes a deviation of the computed value of R from 
its theoretical value, which further entails a residual error in the estimation of A. It was experimentally 
verified that this residual error is around 10"**, the numerical simulations being carried out with double- 
precision floating-point arithmetic. In any case, the estimation of the control parameter of both the logistic 
map and tent map, implies a severe reduction of the key space that must be taken into account when 
designing the cipher. 

4.3. Digital degradation 

A main characteristic of stream ciphers is that the keystreams must have a very long period. In the 
context under examination, the period of the keystreams depends on the periodic behavior of the symbolic 
sequences of the logistic map and the tent map. It is well known that any finite-precision orbit, hence 
any symbolic sequence of chaotic map, is periodic. This problem is especially important in the case of the 
symmetric tent map. In particular, for A = 0.5 the origin is an attractive fix point for all orbits, and this 
represents a complete degradation of the random properties of the corresponding keystreams. Therefore, 



9 



the recommendations given in [6[ must be taken into account in order to avoid the consequences of the 
dynamical degradation. 

5. Conclusions 

In this paper we have analyzed a recent stream cipher that is built on the symbolic sequences of the 
(parametric) logistic and tent maps. We conclude that this cipher is insecure since a chosen-plaintext attack 
makes possible to estimate the control parameter of the underlying chaotic map, based on a "noisy" version 
of the keystream. This estimation can be done with an approximate error that goes from 10~^ (tent map) 
to 10~* (logistic map), what amounts to a strong reduction of the key space. More generally, the results of 
this paper and of [l6| hint to the fact that symbolic sequences of unimodal maps are insecure when used as 
keystreams. 
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